Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very paranoid client who runs two separate networks (one offline, one online) with separate PCs etc.

I have a challenge in that I have written an application for them that will run on the offline network however the network needs to be able to send emails to clients. My idea is to have a one way network connection (like a diode) from the offline server to an online PC that would send the emails.

What is the most effective way to go about this that is semi cost effective? Can I get a one way network card?

Windows Server 2008 Network, Windows PC.

share|improve this question
1  
SMTP is, by definition, a two-way protocol, so you'll never be able to have a true one-way communication. The sending server will always need to receive acknowledgement back from the recipient that the mail was received correctly. –  EEAA Dec 16 '11 at 22:13
3  
How about UUCP via sneakernet? –  EEAA Dec 16 '11 at 22:16
1  
Better is to use IPoAC as the sneaker wearer can be bribed. See: en.wikipedia.org/wiki/IP_over_Avian_Carriers –  Mircea Vutcovici Dec 16 '11 at 22:37
    
Avian carriers can be bribed too.... You just need some bird-seed :-) –  Tonny Dec 16 '11 at 22:44
1  
@ErikA is correct: if you want a literal one-way transfer, UUCP is the time-tested way to deliver messages to the internet from offline computers. Use write-once media (e.g. CD-R discs) if you want to be really sure that you have data moving in only one direction. –  Skyhawk Dec 17 '11 at 3:04

7 Answers 7

up vote 19 down vote accepted

Basically you just need a firewall between the two with really tight rules, basically something called a 'Deny all' rule and then just allow a single one way point to point single port outgoing rule for what you need. This is easy for a security/network guy and should be satisfactory for your client.

share|improve this answer

I would just have two mail servers, an internal and an external. Have the servers continually append outgoing emails to a file, and every so often rename the file, copy it on a USB key, and drop it in an incoming folder on the other server. This is how many installations perform air gaps in network servers.

If it's too important to delay, it can be sent from one of the outside clients.

share|improve this answer

If they've gone to this extent to separate the networks, there should be two firewalls in place here with a mail-enabled box in the middle. On the offline side, only allow connections to this box to dump messages to send via your custom app. On the online side, only allow the smtp connection to the mail server.

You could do the same very cost effectively with a single dual-homed box with software firewall running on each interface but having things separated out will create several additional layers of protection and would be preferable.

share|improve this answer

I would use a serial link that has only the GND and TX on the secured server and GNS and RX on the unsecure network. No flow control as this can be used to leak information from unsecure network to the secured one.

I would create a small SMTP-UDP-SMTP proxy that is composed in 2 daemons. SMTP2UDP and UDP2SMTP.

SMTP2UDP will be a uncompliant MTA that will run on the secure network and accept emails that will send using UDP on the serial link.

UDP2SMTP will run on unsecure network and accept emails via UDP and send them to a real MTA.

On the serial link I would use an optocoupler to make use of the diode in the requirements.

share|improve this answer

The TCP protocol needs two-way communications. This setup sounds similar to a DMZ design, where your app runs in the trusted intranet, and the mailserver and/or recipients exist in the untrusted DMZ zone.

A well-configure firewall will be able to only permit connections to be initiated from the trusted intranet, and not the other way around. If that is not enough, I doubt any physical connection between the two networks will satisfy your client, which means you won't be able to send mail automatically.

share|improve this answer
1  
IP does not require two-way communication. –  MikeyB Dec 16 '11 at 22:18
1  
He was referring to TCP. SMTP is working only trough TCP. And TCP requires 2 way communication. I will edit his answer. –  Mircea Vutcovici Dec 16 '11 at 22:24
    
SMTP needs two way communication. One way for the outbound SMTP commands and the other way for the inbound SMTP responses. The responses from the target SMTP server/process need to be able to reach the SMTP server/process on the source. Since the source server will use an ephemeral port for outbound connections you'll need to configure the source server to always use a predefined port to initiate outbound SMTP communication. That way for firewall rule is locked down to a single source port and a single destination port. –  joeqwerty Dec 16 '11 at 22:34
    
Nothing in the question requires SMTP. There's more than one way to send mail. –  MikeyB Dec 17 '11 at 4:23

If you wanted to implement the requirements to the letter, you could use a one-way IP link that sent its emails via UDP (or a similar unidirectional protocol) to a custom daemon that listened for these packets and sent them out via SMTP to the intended recipient.

Of course, the sending (offline) system would have no idea if they actually went out or not. For this acknowledgement to happen, you need a minimal firewall setup as Ben and Chopper3 have answered.

share|improve this answer

I wouldn't exactly call them paranoid, and I applaud their attitude to security.

If they've gone to the trouble of separate networks, they've probably also gone to the trouble of installing a firewall. A small hole in the firewall which only allows traffic on port 25 to pass from a specific IP address in your offline network to a specific IP address in your online network should do the trick perfectly.

share|improve this answer
7  
Or even better: from a specific mac address. Or even better better: From a specific mac address authenticated by 802.1x –  pauska Dec 16 '11 at 22:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.